Connections and credentials

Add a database connection

This page covers connections you set up by typing a server address and credentials: SQL Server, PostgreSQL, MySQL, and Databricks. For Fabric Warehouse and Fabric Lakehouse, which you pick from your Fabric tenant instead, see Fabric database connections.

In the app: Settings › Organization Settings › External Credentials › Database Connections

Before you start

  • You need the Admin role in the organization.
  • Have a read-only database login ready. Kenseme only ever reads through a connection, so a login that can’t write is the safest thing to give it.
  • For Databricks, have the SQL warehouse’s host and HTTP path, a personal access token, and the Unity Catalog catalog and schema you want to expose.

Add a connection

  1. On the Database Connections page, click Add Connection. It’s a split button: click the arrow to choose the system (for example Add PostgreSQL Connection), or click the button itself to start with SQL Server.
  2. Enter a Name. This is required and is how people pick the connection later.
  3. Add a Description (optional) if it helps.
  4. Fill in the connection fields for your system (see below).
  5. Click Test Connection and wait for the green Connection test succeeded. banner.
  6. Click Create.
[screenshot]
The Add SQL Server Connection dialog with the Server, Database, User, and Password fields.

Connection fields by system

System Fields
SQL Server Server, Database, User, Password, and Additional Options (optional) for extra key=value pairs separated by semicolons, such as Encrypt=True.
PostgreSQL Host, Port (defaults to 5432), Database, Username, Password, and SSL Mode (Disable, Allow, Prefer, Require, VerifyCA, VerifyFull).
MySQL Server, Port (defaults to 3306), Database, User, Password.
Databricks Host, HTTP Path, Access Token, Catalog, and Schema. All five are required.

Warning: If your SQL Server options include TrustServerCertificate=true, the dialog warns you that certificate validation is switched off and credentials could be intercepted. Use a CA-signed certificate on the server where you can.

Databricks is scoped to one catalog and schema

A Databricks connection points at exactly one Unity Catalog catalog and schema, for example main and sales. Everything Kenseme reads through that connection comes from there: schema import, ontology generation, binding snapshots, and Data Agent queries. A binding environment’s schema filters can’t widen it. To reach another schema, add another connection.

Kenseme connects to Databricks through a driver installed on the Kenseme host, so you never type a driver name or a raw ODBC string.

Note: A Databricks SQL warehouse may be stopped. The connection test can take up to 60 seconds while it starts, and the dialog tells you so while you wait.

Paste a full connection string instead

For SQL Server, PostgreSQL, and MySQL, the dialog has a collapsed Paste full connection string section. Expand it and paste a complete connection string if you’d rather not fill in the fields one at a time. When you paste a string, the dialog shows Using the pasted connection string — the structured fields are ignored.

Databricks doesn’t offer this option. It always uses its five fields.

Test a connection

Test Connection checks that Kenseme can reach the database with the details you entered, before you save them. A green banner means it worked. A red banner gives the reason it didn’t.

You can test a saved connection at any time with the Test button on its row. A toast reports the result.

How your credentials are stored

  • The secret part — the password, access token, or pasted connection string — is saved in a secure secret store, separate from the rest of the connection. Kenseme never shows it again. When you edit the connection later, the secret fields are blank; that’s expected.
  • Everything else — the name, the system, a short label for the server, and the description — is stored with the connection and shown on the page.
  • Connection strings are checked against a list of permitted settings for that system before they’re saved. A string with settings outside that list is rejected.

Edit a connection

Click Edit on a connection’s row. You can always change the Name and Description (optional). The database system is fixed once the connection exists and shows as a read-only badge.

To rotate the secret:

  • SQL Server, PostgreSQL, MySQL: type a new value into the Connection string box.
  • Databricks: fill in all five fields under Databricks credentials together. The catalog and schema are stored with the token, so changing either one also needs the token.

Leave the secret fields blank to keep what’s on file. Test Connection in the Edit dialog tests the new value if you entered one, or the stored one if you didn’t. Click Save Changes to finish.

Note: You can’t read a stored secret back. If you’ve lost track of a password or token, rotate it here.

Delete a connection

Click the delete button on the row and confirm. Deleting a connection also deletes its stored secret, and it can’t be undone.

Kenseme refuses to delete a connection that a binding environment still uses. The message names the environments: This connection is in use by 2 binding environment(s): Dev, Prod. Remove those environments first. Delete or re-point those environments, then try again.